Complex event processing (CEP) engines, sometimes referred to as stream processing (SP) engines, often reside on a cloud-based application server. A CEP system analyzes, in real-time, data streams generated by other electronic devices, such as, by way of non-limiting example, sensors. The CEP system analyzes such data streams by searching for one or more predetermined criteria, and if the one or more predetermined criteria are identified, the CEP system generates and sends a notification to a destination. CEP systems may be used to analyze data in a wide variety of different applications, including, by way of non-limiting example, national security, machine to machine (M2M) applications, Internet of things (IoT) devices, and charging/call data records (CDR).
The source devices that generate the data streams may generate data continually, such that a relatively large amount of data may be provided to the CEP system. However, because the predetermined criterion being identified may occur relatively infrequently, much of the data provided to the CEP system may ultimately utilize resources and bandwidth unnecessarily.
FIG. 1 is a block diagram of a system 10 illustrating a conventional CEP module 12. The CEP module 12 resides in a cloud computing environment application server 14. The system 10 also includes a software-defined network (SDN) 16 that includes an ingress datapath node 18-I and an egress datapath node 18-E. SDN is a network architecture where the forwarding plane (sometimes referred to as the data plane) and the control plane, which are conventionally implemented in a single network node, are separated and implemented in two distinct network nodes. Such distinct network nodes may be referred to as a datapath node and a controller node (not illustrated), respectively. An example of an SDN architecture, or specification, is the OpenFlow Switch Specification, version 1.3.0.
A source device 22 generates a relatively continual stream of packets 24-1-24-N (generally, packets 24) and transmits the packets 24 toward one or more destination devices 26 (only one illustrated for purposes of clarity). The source device 22 may comprise any suitable electronic device capable of generating packets of information that it may be desirable to examine. For purposes of illustration, assume that the source device 22 comprises a video camera positioned to capture imagery of an area. The source device 20 is coupled to the ingress datapath node 18-I which receives the packets 24. The ingress datapath node 18-I, based on a flow entry in a flow table (not illustrated), sends the packets 24 to the egress datapath node 18-E for delivery to the destination device 26. The ingress datapath node 18-I also sends, via a network 28, a copy of each packet 24 to the CEP module 12, for complex event processing. In this embodiment, for example, the CEP module 12 may analyze the imagery contained in the packets 24 to determine if a particular individual is depicted in the imagery. Thus, each packet 24 generated by the source device is duplicated and communicated to the CEP module 12, utilizing bandwidth of the network 28.
While for purposes of illustration only a single source device 22 is shown, tens or hundreds of source devices 22 may be concurrently generating data streams of packets 24, each of which may be provided to the CEP module 12, either via the ingress datapath node 18-I or via other ingress datapath nodes. For example, tens or hundreds of source devices 22 that comprise video cameras may collectively provide millions of packets of imagery of adjacent respective areas for analysis by the CEP module 12. In actuality, only a small percentage of such packets may depict any individuals at all, and consequently the majority of the packets provided to the CEP module 12 utilized bandwidth of the network 28 unnecessarily.